PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43384 Git CVE debrief

CVE-2026-43384 is a critical Linux kernel vulnerability in the TCP Authentication Option (TCP-AO) path. The fix changes MAC comparison to a constant-time helper to prevent timing attacks. In practical terms, an attacker able to exercise the affected network path could potentially learn information from data-dependent comparison timing. The supplied record rates the issue CVSS 9.8 (Critical).

Vendor
Git
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-26
Advisory published
2026-05-08
Advisory updated
2026-05-26

Who should care

Linux kernel maintainers, distro security teams, appliance and embedded vendors shipping Linux kernels, and operators of systems that use or expose TCP-AO. Network-security teams should prioritize this if TCP-AO is enabled in production or on internet-facing systems.

Technical summary

The CVE description says the Linux kernel's net/tcp-ao code compared MACs in a way that was not constant time. Because MAC verification should not vary its runtime based on how much of the value matches, the resolved change uses the appropriate constant-time comparison helper. The issue is therefore a timing-side-channel risk in authentication verification logic rather than a memory corruption flaw.

Defensive priority

Urgent; treat as critical and prioritize kernel patching/backport verification immediately.

Recommended defensive actions

  • Apply the vendor or distribution kernel update that includes the TCP-AO constant-time MAC comparison fix.
  • Verify any backports in stable kernel branches include the net/tcp-ao timing fix before deployment.
  • Prioritize exposed or high-trust systems that use TCP-AO for authentication.
  • If TCP-AO is not required on a system, restrict or disable its use until patched.
  • Track downstream advisories from your Linux distribution or kernel vendor for exact fixed versions.

Evidence notes

This debrief is based on the CVE description stating that net/tcp-ao needed constant-time MAC comparison, plus the official NVD record and its four kernel.org stable commit references. The supplied NVD metadata shows vulnStatus as 'Received' and CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, consistent with a remotely reachable critical issue.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43384 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43384

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43384 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43384

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/080b0e210088296dd50d6637c06c1db14246adfe

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/67edfec516d30d3e62925c397be4a1e5185802fc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8be6ed64966da48b6c4726918f106c18742a5125

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a269cbdc442f8658bca35383e34b9d0b0ff95a1c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.